sec_review_cve-2024-3094

オープンソースの脆弱性 CVE-2024-3094 の完全なセキュリティレビューが実施されました。得られたデータに基づき、以下を作成しました： 1. レポート「ThreatModel + SecurityReview」 – 脅威の詳細な説明、攻撃 経路、リスク評価、攻撃対象領域を縮小するための推奨事項。 2. 検証テストパッケージ – パッチ適用後に脆弱性の有無を 確認する自動テスト一式。 レポートは ReportFinal.pdf ファイルに収録されています。 情報源： 脆弱性のあるバージョンのアーカイブ：https://github.com/thesamesam/xz-archive...

EUVD-2015-2760

Malware in sbrugna...

SUSE CVE-2015-2668

ClamAV before 0.98.7 allows remote attackers to cause a denial of service infinite loop via a crafted xz archive file...

ClamAV < 0.98.7 Multiple DoS Vulnerabilities - Linux

ClamAV is prone to multiple denial of service DoS vulnerabilities. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:clamav:clamav"...

ClamAV < 0.98.7 Multiple DoS Vulnerabilities - Windows

ClamAV is prone to multiple denial of service DoS vulnerabilities. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:clamav:clamav"...

Fedora 20 : clamav-0.98.7-1.fc20 (2015-7378)

ClamAV 0.98.7 ============= This release contains new scanning features and bug fixes. - Improvements to PDF processing: decryption, escape sequence handling, and file property collection. - Scanning/analysis of additional Microsoft Office 2003 XML format. - Fix infinite loop condition on crafted...

CVE-2015-2668

ClamAV before 0.98.7 allows remote attackers to cause a denial of service infinite loop via a crafted xz archive file...

CVE-2015-2668

ClamAV before 0.98.7 allows remote attackers to cause a denial of service infinite loop via a crafted xz archive file...

Code injection

ClamAV before 0.98.7 allows remote attackers to cause a denial of service infinite loop via a crafted xz archive file...

CVE-2015-2668

ClamAV before 0.98.7 allows remote attackers to cause a denial of service infinite loop via a crafted xz archive file...

ClamAV < 0.98.7 Multiple Vulnerabilities

According to its version, the ClamAV clamd antivirus daemon on the remote host is prior to 0.98.7. It is, therefore, affected by multiple vulnerabilities : - An unspecified flaw exists in the pefromupx function in upx.c. A remote attacker can exploit this flaw, via a specially crafted file, to...

clamav: multiple issues

CVE-2015-2170 denial of service A flaw has been found in the UPX decoder with crafted files. During unpacking there are two range checks which are implemented "manually". Those checks lack the detection of overflows which are considered by the CLIISCONTAINED macro. - CVE-2015-2221 denial of...

UBUNTU-CVE-2015-2668

ClamAV before 0.98.7 allows remote attackers to cause a denial of service infinite loop via a crafted xz archive file...

CVE-2015-2668

ClamAV before 0.98.7 allows remote attackers to cause a denial of service infinite loop via a crafted xz archive file...

DEBIAN-CVE-2014-9357

Docker 1.3.2 allows remote attackers to execute arbitrary code with root privileges via a crafted 1 image or 2 build in a Dockerfile in an LZMA .xz archive, related to the chroot for archive extraction...